CVE Vulnerabilities

CVE-2019-14563

Incorrect Conversion between Numeric Types

Published: Nov 23, 2020 | Modified: Jan 01, 2022
CVSS 3.x
7.8
HIGH
Source:
NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
4.6 MEDIUM
AV:L/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
6.4 MODERATE
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L
Ubuntu
LOW

Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.

Weakness

When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.

Affected Software

Name Vendor Start Version End Version
Edk2 Tianocore - (including) - (including)
Edk2 Ubuntu bionic *
Edk2 Ubuntu eoan *
Edk2 Ubuntu esm-apps/bionic *
Edk2 Ubuntu esm-apps/xenial *
Edk2 Ubuntu trusty *
Edk2 Ubuntu xenial *
Red Hat Enterprise Linux 8 RedHat edk2-0:20190829git37eef91017ad-9.el8 *

Potential Mitigations

References